IKEv2 to Cisco ASA results in TS mismatch when initiation triggered by traffic
IKEv2 to Cisco ASA won't come up when initiation is triggered by traffic matching the P2. It results in the following on the ASA.
Local:172.27.44.49:500 Remote:172.27.44.26:500 Username:172.27.44.26 IKEv2 Tunnel rejected: Crypto Map Policy not found for remote traffic selector 192.168.152.0/192.168.152.255/0/65535/0 local traffic selector 192.168.25.0/192.168.25.255/0/65535/0!
But if you run 'ipsec up con1', it comes up and works fine. It also rekeys fine on its own.
#1 Updated by Chris Buechler about 4 years ago
- Assignee set to Chris Buechler
- Target version changed from 2.2.3 to 2.3
this is still replicable as described, but only with ASAs, and only as initiator when triggered by traffic. Manually connecting it is fine, it's fine if it's responder, it rekeys no problem indefinitely. Google GCE cloud VPNs, various strongswan versions on Linux all fine. openiked doesn't work with PSK apparently so not an exactly comparable test with certs, but it works too. Will revisit.
#4 Updated by Chris Buechler over 3 years ago
- File asa-failed.pcap added
- File asa-works.pcap added
- File asa-failed.txt added
- File asa-works.txt added
- Affected Version changed from 2.2.2 to 2.2.x
Still the same issue with latest strongswan. Attaching some ASA logs and pcaps. I'll give Linux a shot again to compare.